Medium
CVE-2026-42760
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-42757
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-42755
TableOn – WordPress Posts Table Filterable <= 1.0.5.1 - Unauthenticated SQL Injection
Critical
CVE-2026-42758
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Unauthenticated Privilege Escalation
High
CVE-2026-42759
Affiliate Super Assistent <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-47416
praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}
Critical
CVE-2026-47410
praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
Critical
CVE-2026-47407
PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
Critical
CVE-2026-47391
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
Critical
CVE-2026-47392
PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
Medium
CVE-2026-47395
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Critical
CVE-2026-47396
PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
Medium
CVE-2026-47390
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
High
CVE-2026-47398
PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334
High
CVE-2026-47266
formie's unauthenticated front-end submission editing can overwrite existing submissions
Critical
CVE-2026-76242
stigmem-node's federation peer registration lacked explicit out-of-band approval
High
CVE-2026-76241
stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment
Critical
CVE-2026-76244
stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation
High
CVE-2026-76240
stigmem-node's Postgres schema identifier handling required defensive quoting
High
CVE-2026-76245
stigmem-node's federation peer token timestamp validation may reject valid peer tokens
Critical
CVE-2026-76243
stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback
Medium
CVE-2026-47233
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
Medium
CVE-2026-47234
Admidio writes session IDs and auto-login cookie values to application logs
Medium
CVE-2026-47232
Admidio PKCS#12 private key export action lacks CSRF protection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.